Index: /trunk/src/VBox/Devices/Network/slirp/ip_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_input.c	(revision 30349)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_input.c	(revision 30350)
@@ -121,5 +121,5 @@
         int rc;
         STAM_PROFILE_START(&pData->StatALIAS_input, b);
-        rc = LibAliasIn(select_alias(pData, m), mtod(m, char *), m->m_len);
+        rc = LibAliasIn(select_alias(pData, m), mtod(m, char *), m_length(m, NULL));
         STAM_PROFILE_STOP(&pData->StatALIAS_input, b);
         Log2(("NAT: LibAlias return %d\n", rc));
@@ -196,5 +196,6 @@
     {
         icmp_error(pData, m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, "ttl");
-        goto bad;
+        /* don't let this mbuf to be freed */
+        return;
     }
 
Index: /trunk/src/VBox/Devices/Network/slirp/slirp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30349)
+++ /trunk/src/VBox/Devices/Network/slirp/slirp.c	(revision 30350)
@@ -1444,5 +1444,4 @@
                 memcpy(rah->ar_tip, ah->ar_sip, 4);
                 if_encap(pData, ETH_P_ARP, mr, ETH_ENCAP_URG);
-                m_freem(pData, m);
             }
             /* Gratuitous ARP */
@@ -1456,5 +1455,4 @@
                 if (slirp_arp_cache_update(pData, *(uint32_t *)ah->ar_tip, &eh->h_dest[0]) == 0)
                 {
-                    m_freem(pData, mr);
                     m_freem(pData, m);
                     break;
Index: /trunk/src/VBox/Devices/Network/slirp/tcp_input.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 30349)
+++ /trunk/src/VBox/Devices/Network/slirp/tcp_input.c	(revision 30350)
@@ -798,5 +798,4 @@
                 }
                 tp = tcp_close(pData, tp);
-                m_freem(pData, m);
             }
             else
Index: /trunk/src/VBox/Devices/Network/slirp/udp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30349)
+++ /trunk/src/VBox/Devices/Network/slirp/udp.c	(revision 30350)
@@ -190,10 +190,12 @@
         dst.sin_addr.s_addr = ip->ip_src.s_addr;
         dst.sin_port = uh->uh_sport;
-        /* udp_output2 will do opposite operations on mbuf*/
+
+        /* udp_output2 expects pointer on the body of UDP packet. */
 
         m->m_data += sizeof(struct udpiphdr);
         m->m_len -= sizeof(struct udpiphdr);
         udp_output2(pData, NULL, m, &src, &dst, IPTOS_LOWDELAY);
-        goto done;
+        /* we shouldn't free this mbuf*/
+        return;
     }
     /*